3 ms·
You're right, but also, commit signing is useless if there’s nobody on the other side verifying that the signature can be trusted. GitHub is doing that right no
by kohbo 3y ago
You're right, but also, commit signing is useless if there’s nobody on the other side verifying that the signature can be trusted. GitHub is doing that right now but that also ties projects to GitHub. It's Microsoft's way off ensuring OSS development has to go through their gates.
- ZiiS 3y agoYou can `git verify-commit` yourself. Gpg allows you to build a web of trust so you can find other people who trusts the commiter's key.